Need

Protection of sensitive business information from unauthorized access or disclosure

Context

• Usage of Scala for building scalable and functional applications
• Usage of play.api.mvc for handling HTTP requests and responses in Play Framework
• Usage of scala.concurrent.ExecutionContext.Implicits.global for managing concurrent execution in Scala
• Usage of play.api.libs.json.Json for JSON parsing and serialization in Play Framework

Description

Non compliant code

        import play.api.mvc._
import scala.concurrent.ExecutionContext.Implicits.global
import play.api.libs.json.Json

class CustomerController @Inject()(cc: ControllerComponents) extends AbstractController(cc) {

  def getCustomers = Action.async { implicit request: Request[AnyContent] =>
    val customers = CustomerService.getAllCustomers() // Assume this function fetches all customer data from the database
    Ok(Json.toJson(customers))
  }
}
        
        

The above code represents a Scala backend application that uses the Play framework. It defines a controller named CustomerController with a method getCustomers. This method retrieves all customers' data from the database and sends it as a response in JSON format.

The vulnerability here is that the getCustomers method is exposing all the customers' data without any form of authorization or filtering. This means any client that can send a request to the route associated with this method can obtain sensitive information like customer lists, emails, phone numbers, or identifiers.

This vulnerability can lead to a business information leak where sensitive information about customers or providers can be obtained from the application. This is a severe issue as it directly impacts the privacy and security of the users' data.

To fix this vulnerability, we should implement proper authorization checks to ensure only authorized users can access the data. Additionally, we should filter the data sent as a response to ensure only non-sensitive data is exposed.

Steps

• Implement proper access control and authentication mechanisms to ensure that only authorized users can access sensitive information.
• Apply data masking or encryption techniques to protect sensitive information stored in the application's database.
• Implement input validation and sanitization to prevent any malicious input that could lead to information leakage.
• Review and update the application's logging mechanisms to ensure that sensitive information is not logged or exposed in log files.
• Regularly perform security assessments and penetration testing to identify and address any potential vulnerabilities in the application.
• Keep the application and all its dependencies up to date with the latest security patches and updates.
• Educate developers and users about best practices for handling sensitive information and the importance of data protection.

Compliant code

        import play.api.mvc._
import scala.concurrent.ExecutionContext.Implicits.global
import play.api.libs.json.Json
import javax.inject.Inject

class CustomerController @Inject()(cc: ControllerComponents, authService: AuthService) extends AbstractController(cc) {

  def getCustomers = Action.async { implicit request: Request[AnyContent] =>
    authService.authenticate(request).map { user =>
      if (user.hasRole("admin")) {
        val customers = CustomerService.getAllCustomers() // Assume this function fetches all customer data from the database
        Ok(Json.toJson(customers))
      } else {
        Forbidden("You do not have permission to access this resource.")
      }
    }.recover {
      case _ => Unauthorized("Invalid credentials.")
    }
  }
}
        
        

The updated code includes an AuthService that is used to authenticate the user making the request. This service is injected into the CustomerController and used in the getCustomers action.

The getCustomers action now first authenticates the user making the request. If the authentication is successful, it checks if the user has the "admin" role. If the user is an admin, it fetches the customer data and returns it. If the user is not an admin, it returns a "Forbidden" response. If the authentication fails, it returns an "Unauthorized" response.

This ensures that only users with the "admin" role can access the customer data, which helps prevent sensitive information from being leaked.

In addition to this, it's recommended to apply data masking or encryption techniques to protect sensitive information stored in the application's database. Implement input validation and sanitization to prevent any malicious input that could lead to information leakage. Review and update the application's logging mechanisms to ensure that sensitive information is not logged or exposed in log files. Regularly perform security assessments and penetration testing to identify and address any potential vulnerabilities in the application. Keep the application and all its dependencies up to date with the latest security patches and updates. Educate developers and users about best practices for handling sensitive information and the importance of data protection.

References

• 080. Business information leak - Customers or providers